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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 

SEP  2  3  2011 

MEMORANDUM  FOR  AUDITOR  GENERAL,  DEPARTMENT  OF  THE  NAVY 

SUBJECT:  Quality  Control  Review  of  Naval  Audit  Service’s  Special  Access 
Program  Audits  (Report  No.  D-201 1-6-012) 

We  are  providing  this  report  for  your  information  and  use.  We  reviewed  the  Naval  Audit 
Service’s  (NAS)  system  of  quality  control  over  Special  Access  Programs  (SAP)  audits 
for  the  two  years  ended  September  30,  2010.  The  generally  accepted  government 
auditing  standards  (GAGAS)  requires  that  an  audit  organization  performing  audits  and/or 
attestation  engagements  in  accordance  with  GAGAS  should  have  an  appropriate  internal 
quality  control  system  in  place  and  undergo  an  external  peer  review  at  least  once  every 
three  years  by  reviewers  independent  of  the  audit  organization  being  reviewed.  As  the 
organization  that  has  audit  policy  and  oversight  responsibilities  for  audits  in  the  DOD,  we 
conducted  the  external  quality  control  review  of  the  NAS  SAP  audits  in  conjunction  with 
the  Air  Force  Audit  Agency’s  review  of  the  NAS  non-SAP  audits. 

An  audit  organization’s  quality  control  policies  and  procedures  should  be  appropriately 
comprehensive  and  suitably  designed  to  provide  reasonable  assurance  of  meeting  the 
objectives  of  quality  control.  We  tested  the  NAS  SAP  system  of  quality  control  for 
audits  to  the  extent  considered  appropriate. 

In  our  opinion,  the  system  of  quality  control  for  the  audit  function  of  NAS  SAP  in  effect 
for  the  period  ended  September  30,  2010,  was  designed  in  accordance  with  quality 
standards  established  by  GAGAS.  Further,  the  internal  quality  control  system  was 
operating  effectively  to  provide  reasonable  assurance  that  SAP  audit  personnel  were 
following  established  policies,  procedures,  and  applicable  auditing  standards. 
Accordingly,  we  are  issuing  a  pass  opinion  on  your  SAP  audit  quality  control  system  for 
the  review  period  ended  September  30,  2010. 

Appendix  A  contains  comments,  observations  where  NAS  can  improve  its  quality  control 
system.  Appendix  B  contains  the  scope  and  methodology  of  the  review.  We  appreciate 
the  courtesies  extended  to  the  staff.  Questions  should  be  directed  to 
Ms.  Carolyn  R.  Davis  at  (703)  604-8877  (DSN  664-8877)  or  Carolyn.Davis@dodig.mil. 


Deputy  Inspector  General 
Policy  and  Oversight 


Appendix  A.  Comments,  Observations,  and 
Recommendation 

We  are  issuing  a  pass  opinion  because  we  detennined  that  the  NAS  quality  control 
system  is  adequately  designed  and  functioning  as  prescribed.  We  identified  one  area  of 
concern  related  to  quality  control.  We  judgmentally  tested  the  reports  for  compliance 
with  GAGAS  and  NAS  audit  policies  in  nine  areas  to  include  independence,  professional 
judgment,  competence,  audit  planning,  supervision,  evidence,  audit  documentation, 
reporting,  and  quality  control. 

Quality  Control 

We  identified  that  for  one  audit  reviewed  the  working  papers  did  not  include  a 
referencing  guide  sheet  that  is  part  of  the  quality  control  procedures  outlined  in  the  Naval 
Audit  Service  Handbook.  GAGAS  3.50a  (2007  Revision)  states  that  each  audit 
organization  perfonning  audits  or  attestation  engagements  in  accordance  with  GAGAS 
must  establish  a  system  of  quality  control  that  is  designed  to  provide  the  audit 
organization  with  reasonable  assurance  that  the  organization  and  its  personnel  comply 
with  professional  standards  and  applicable  legal  and  regulatory  requirements.  GAGAS 
3.51  requires  that  an  audit  organization’s  system  of  quality  control  encompasses  the  audit 
organization’s  leadership,  emphasis  on  perfonning  high  quality  work,  and  the 
organization’s  policies  and  procedures  designed  to  provide  reasonable  assurance  of 
complying  with  professional  standards  and  applicable  legal  and  regulatory  requirements. 

Naval  Audit  Service  Handbook,  Chapter  5,  Section  511,  4(b),  dated  December  2010, 
states  that  the  referencer  will  electronically  complete  the  mandatory  referencing  guide 
sheet.  Previous  versions  of  the  NAS  Handbook  to  include  one  dated  November  2008 
also  contained  the  requirement  for  a  mandatory  referencing  guide  sheet.  The  guide  sheet 
notes  specific  issues  the  referencer  must  consider  throughout  the  report,  and  also  lists  a 
number  of  key  issues  the  referencer  must  consider  regarding  the  working  paper.  While 
this  section  of  the  NAS  Handbook  refers  specifically  to  electronic  working  papers,  the 
NAS  Special  Audit  Division  had  prepared  working  papers  in  hard  copy  documentation. 
The  hard  copy  documentation  for  one  audit  report  reviewed,  dated  July  2009,  did  not 
include  the  mandatory  referencing  guide  sheet  as  the  NAS  Handbook  requires.  Although, 
the  referencer  either  did  not  complete  the  mandatory  referencing  guide  sheet  or  did  not 
document  it  in  the  audit  documentation,  the  items  that  the  referencer  was  required  to 
check  was  included  in  the  audit  documentation. 

Recommendation:  We  recommend  that  the  Auditor  General  of  the  Navy  issue  a 
memorandum  to  remind  all  SAP  audit  personnel  the  importance  of  complying  with 
established  audit  guidance  relating  to  quality  control  for  documenting  the  referencing 
guide  sheet  in  both  electronic  and  hard  copy  audit  documentation. 
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Management  Comments:  Naval  Audit  Service’s  Assistant  Auditor  General,  Plans, 
Policy  and  Resources  Management  concurred  with  the  recommendation  and  stated  that 
an  all-hands  e-mail  will  be  sent  to  the  staff  reminding  them  of  the  importance  of 
complying  with  established  guidelines  for  documenting  independent  referencing, 
including  retaining  the  referencing  guide  sheet  in  the  audit  documentation. 

Reviewer  Response:  Management  comments  are  responsive.  The  Naval  Audit 
Service’s  Auditor  General  sent  an  all-hands  e-mail  dated  September  21,  2011.  The 
e-mail  reminds  auditors  perfonning  special  access  program  audits  that  all  ongoing  and 
future  audits  must  comply  with  established  quality  control  guidelines  for  documenting 
independent  referencing,  including  retaining  the  referencing  guide  sheet  in  the  official 
hardcopy  or  electronic  audit  documentation. 
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Appendix  B.  Scope  and  Methodology 

We  limited  our  review  to  the  adequacy  of  NAS  SAP  audits’  compliance  with  quality 
policies,  procedures,  and  standards.  We  judgmentally  selected  two  SAP  audits  from  a 
universe  of  five  SAP  audit  reports  issued  by  NAS  SAP  auditors  during  FY  2009  and 
FY  2010.  We  tested  each  audit  for  compliance  with  the  NAS  system  of  quality  control. 
The  Air  Force  Audit  Agency  conducted  a  review  of  the  NAS  internal  quality  control 
system  for  non-SAP  audits  and/or  attestation  engagements  and  will  issue  a  separate 
report.  The  Deputy  Inspector  General  for  Policy  and  Oversight  will  issue  an  overall 
opinion  report  on  the  NAS  internal  quality  control  system  that  will  include  the  combined 
results  of  the  SAP  and  non-SAP  audit  reviews. 

In  performing  our  review,  we  considered  the  requirements  of  quality  control  standards 
contained  in  the  2007  Revision  of  GAGAS  issued  by  the  Comptroller  General  of  the 
United  States  GAGAS  3.56  states: 

The  audit  organization  should  obtain  an  external  peer  review 
sufficient  in  scope  to  provide  a  reasonable  basis  for  detennining 
whether  the  audit  organization  is  complying  with  its  quality  control 
system  in  order  to  provide  the  audit  organization  with  reasonable 
assurance  of  confonning  with  applicable  professional  standards. 

We  conducted  this  review  in  accordance  with  standards  and  guidelines  established  in  the 
March  2009  Council  of  the  Inspectors  Generals  on  Integrity  and  Efficiency  “Guide  for 
Conducting  External  Peer  Reviews  of  Audit  Organizations  of  the  Federal  Offices  of 
Inspector  General,”  and  the  Quality  Standards  for  Inspection  and  Evaluation.  The  Air 
Force  Audit  Agency  used  this  guide  for  review  of  the  non-SAP  audits  at  the  NAS.  We 
reviewed  audit  documentation,  interviewed  NAS  auditors,  and  reviewed  NAS  internal 
audit  policies.  We  reviewed  the  DOD  OIG  Report  No.  D-2009-6-001,  “Quality  Control 
Review  of  the  Naval  Audit  Service’s  Special  Access  Program  Audits”  dated 
October  9,  2008.  We  performed  this  review  from  June  to  August  2011  at  one  NAS 
office. 

We  used  the  following  criteria  to  select  the  audits  under  review: 

•  Worked  backward  starting  with  the  FY  2010  audits  in  order  to  review  the 
most  current  quality  assurance  procedure  in  place. 

•  Avoided  audits  with  multiple  SAPs  associated  with  the  audit  for  ease  of 
access. 

•  Avoided  audits  that  have  the  same  or  similar  titles  to  ensure  review  of 
multiple  types  of  projects. 
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The  following  table  identifies  the  specific  reports  reviewed. 


Report  Number 

Date 

Title 

N2010-0056 

September  15,  2010 

Use  and  Control  of  Military 
Interdepartmental  Purchase 
Request  (MIPR)  Funds  at 
Classified  Activities 

N2009-0042 

July  31,  2009 

Funds  Usages  for 

Department  of  Navy  (DON) 
Integrated  Fire  Control 
(IFC)  Developments 

Limitations  of  Review.  Our  review  would  not  necessarily  disclose  all  weaknesses  in  the 
system  of  quality  control  or  all  instances  of  noncompliance  with  it  because  we  based  our 
review  on  selective  tests.  There  are  inherent  limitations  in  considering  the  potential 
effectiveness  of  any  quality  control  system.  In  performing  most  control  procedures, 
departures  can  result  from  misunderstanding  of  instructions,  mistakes  of  judgment, 
carelessness,  or  other  human  factors.  Projecting  any  evaluation  of  a  quality  control 
system  into  the  future  is  subject  to  the  risk  that  one  or  more  procedures  may  become 
inadequate  because  conditions  may  change  or  the  degree  of  compliance  with  procedures 
may  deteriorate. 


5 


Department  of  the  Navy-Naval  Audit  Service 
Comments 


DEPARTMENT  OF  THE  NAVY 

NAVAL  AUDIT  SERVICE 
1006  BEATTY  PLACE  SE 
WASHINGTON  NAVY  YARD  DC  20374-5005 


7510 
8  Sep  1 1 

MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 
(ASSISTANT  INSPECTOR  GENERAL  FOR  AUDIT 
POLICY  AND  OVERSIGHT) 

RESPONSE  TO  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 
DRAFT  QUALITY  CONTROL  REVIEW  REPORT  ON  NAVAL  AUDIT 
SERVICE’S  SPECIAL  ACCESS  PROGRAM 

(a)  Memorandum  for  the  Auditor  General,  Department  of  the  Navy  -  Quality 
Control  Review  of  Naval  Audit  Service’s  Special  Access  Program  Audits 
(Project  No.  D201 1-D1P0AI-01 18.000),  dated  23  Aug  2011 

(1 )  Department  of  Defense  Inspector  General  (Assistant  Inspector  General  for 
Audit  Policy  and  Oversight)  Recommendation  and  Naval  Audit  Service 
Response 

1 .  We  have  reviewed  your  report  on  our  Special  Access  Program  audits  (reference  (a)), 
and  are  pleased  the  Department  of  Defense  Inspector  General  has  provided  us  with  a 
rating  of  Pass  on  our  audit  quality  control  system  for  the  review  period  ended 

30  September  2010.  Enclosure  (1)  contains  our  response  to  the  recommendation  made  in 
the  report. 

2.  If  you  have  any  questions,  or  would  like  additional  infonnation,  please  contact 

Ms.  Vicki  McAdams,  Director  of  Policy  and  Oversight,  at  vicki  mcadams@navy.mil  or 
(202)  433-5854. 


SAMUEL  CHASON 

Assistant  Auditor  General 

Plans,  Policy  and  Resources  Management 


Subj: 


Ref: 


Enel: 
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Department  of  Defense  Inspector  General  (Assistant 
Inspector  General  for  Audit  Policy  and  Oversight) 
Recommendation  and  Naval  Audit  Service  Response 

Naval  Audit  Service  Overall  Comment 

Wc  arc  pleased  to  receive  a  rating  of  Pass  on  our  Special  Access  Program  audit 
quality  control  system  for  the  review  period  ended  30  September  2010.  We  have 
evaluated  the  report  and  concur  with  the  recommendation. 

Naval  Audit  Service  Response  to  Recommendation 

Recommendation  1.  We  recommend  that  the  Auditor  General  of  the  Navy  issue  a 
memorandum  to  remind  all  SAP  audit  personnel  the  importance  of  complying  with 
established  audit  guidance  relating  to  quality  control  for  documenting  the  referencing 
guide  sheet  in  both  electronic  and  hard  copy  audit  documentation. 

Naval  Audit  Service  Response.  Concur.  An  All-Hands  e-mail  will  be  sent  to  the 
staff  reminding  them  of  the  importance  of  complying  with  established  guidelines  for 
documenting  independent  referencing,  including  retaining  the  referencing  guide  sheet 
in  the  audit  documentation. 


Enclosure  (1) 
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